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Abstract. The concept of asymptotic correctability of Bell-diagonal quantum states 
is generalised to elementary quantum systems of higher dimensions. Based on these 
results basic properties of quantum state purification protocols are investigated which 
are capable of purifying tensor products of Bell-diagonal states and which are based on 
B-steps of the Gottesman-Lo-type with the subsequent application of a Calderbank- 
Shor-Steane quantum code. Consequences for maximum tolerable error rates of 
quantum cryptographic protocols are discussed. 
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1. Introduction 

Quantum state purification protocols which are based on local operations and classical 
communication and which are capable of purifying tensor products of Bell-diagonal 
quantum states are of considerable current interest in the area of quantum cryptography. 
This may be traced back to the fact that the security analysis and questions concerning 
achievable secret-key rates of many quantum cryptographic protocols are based on basic 
properties of such quantum-state purification protocols [TJ So far, a satisfactory 
understanding of such protocols has already been obtained in qubit-based scenarios. 
In particular, it was demonstrated that powerful quantum-state purification protocols 
can be developed for tensor products of Bell-diagonal states by combining a sufficiently 
large number of purification steps involving classical two-way communication, so called 
5-steps [Sj, with subsequent quantum error correction based on Calderbank-Shor-Steane 
(CSS) codes [3j which involve classical one-way communication only. Furthermore, the 
asymptotic properties of these protocols for large numbers of 5-steps can be analysed 
in a convenient way by characteristic exponents which govern the relation between bit- 
and phase errors Based on such an analysis it is straightforward, for example, 
to determine maximally tolerable bit-error probabilities of quantum cryptographic 
protocols of the prepare-and-measure type whose security analysis can be reduced to the 
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purification of Bell-diagonal qubit states [21 El El E] • Contrary to qubit-based scenarios, 
elementary properties of quantum-state purification protocols are still rather unexplored 
in quantum cryptographic contexts in which the transfer of quantum information is 
based on higher-dimensional elementary quantum systems, so called qudits. 

Recently, some qudit-based quantum cryptographic protocols were developed whose 
security analysis can be related to basic properties of quantum-state purification 
protocols capable of purifying tensor products of generalized Bell-diagonal quantum 
states 0IH1IS!- Motivated by these current developments in this paper the asymptotic 
properties of qudit-based quantum-state purification protocols are investigated which 
involve 5-steps and the subsequent application of a CSS code fulfilling the Shannon 
bound of Hamada [TU] . For this purpose, the previously developed concept of asymptotic 
correctability is generalized to arbitrary-dimensional elementary quantum systems and 
corresponding relevant exponents are determined which govern the relation between dit- 
and phase errors for large numbers of purification steps (compare with theorem |2J). In 
quantum cryptographic applications the phase-error probabilities are not accessible to 
direct measurement, but they have to be estimated on the basis of the measured qudit- 
error probabilities. For this purpose it is convenient to start a purification protocol with 
a local unitary mixing transformation which homogenises the phase errors associated 
with each possible dit error. The asymptotic correctability under the resulting quantum- 
state purification protocol can be determined in a rather straightforward way (compare 
with theorem EJ). This latter result is particularly useful for determining lower bounds 
on maximally tolerable qudit-error probabilities of quantum cryptographic protocols 
whose security analysis can be reduced to the asymptotic correctability under these 
latter quantum-state purification protocols. 

This paper is organized as follows: In section [21 basic notions of qudit-systems, such 
as the definition of generalised Bell states, are summarized. Section El is devoted to the 
definition of asymptotic correctability of general quantum state purification protocols 
which involve tensor products of generalized Bell-diagonal qudit states. In particular, 
theorem El relates this asymptotic correctability to basic properties of exponents which 
govern the relation between dit and phase errors. Section 0] specializes these results to 
purification protocols which start with a local mixing operation followed by generalised 
5-steps and a subsequent application of a CSS quantum code. In Section flower bounds 
on maximally tolerable dit-error probabilities of quantum cryptographic protocols are 
discussed whose postprocessing can be reduced to the analysis of such purification 
protocols. 

2. Quantum systems of dimension d 

We consider a quantum system of dimension d, which is called a qudit. A certain 
orthonormal basis of the associated Hilbert space TC = C d is labelled by the elements 
of the set := {0, . . . , d — 1}, which are representatives of the ring of residue classes 
Z/gK, i.e. we consider all operations modulo d; we denote addition and subtraction 
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by "©" and "0", respectively. We further denote Z* d := Z d \ {0}4 In analogy to the 
abbreviation "bit" for "binary digit" we use the term "dit" for "ci-ary digit" . 

We will need the notion of a probability distribution on d elements, which can be 
identified with normalised <i-tuples of non-negative real numbers. For convenience, we 
denote the set of such tuples by 

d-l 



W d := { (p ,...,p d -i) e 



E 

i=0 



Pi 



1; pi > for all i 



(1) 



For such a probability distribution p = (p , . . . ,Pd-i) G the Shannon entropy is 
defined by 

d-l d-l 

H d(p) ■= - ^2pi~log d Pi = -(lncfT 1 ^^^. (2) 

i=0 i=0 

The Hilbert space of a pair of qudits, i. e. 7i <8> 1~L, has a basis of maximally entangled 
states, which we call the (generalised) Bell basis of this system. It is defined by [TT| 

'd-l 



Y,z lk \k)\kem) 



k=0 



for I, m G TLdi 



(3) 



where z := exp(27ri/(i) is the principal root of unity of order d. We denote the associated 
density matrices by (l,m) := |^ m )(^ m |. We will frequently use classical mixtures of 
generalised Bell states, i. e. states of the form 



d-i 

E 

l,m=0 



p= A im\^im){^iml where {A lm )fJ =0 eW d xd- (4) 



Such mixtures we will identify with their coefficient matrix§, so that we can write 

/ ^4oo ^4oi • • • Ao t d-i \ 
Aio An ■ ■ ■ Aid-i 



p = (Ai m ) 



i-i 

l,m=0 



(5) 



/ 



\ Ad-i y o Ad-i,i ■ ■ ■ Ad-i^d-i 

The only condition on the entries is, that they form a probability distribution on x Z<j, 
i. e. that all Ai m are non-negative and sum up to one. The set of all such mixtures of 
generalised Bell states will be denoted by <S^ . 

We will consider |^oo) as t ne reference state for purification, so that we can interpret 
I and m as phase and dit errors, respectively. The columns of the coefficient matrix 
thus represent different dit values, whereas the rows represent different phase values. 
Marginal distributions of dit and phase errors are therefore given by 

d-l d-l 

A* m := y]Ai m for meZ d and A^ := A im for I e Z d . (6) 

1=0 1=0 
| Unless d is a prime, does not represent the set of invertible elements of Z/cZZ. 
§ The coefficient matrix is not a density matrix on a Hilbert space. 
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A generalised XOR operation on two qudits, the source and the target, is defined by 
GXOR|fc)|i) := \k)\kQl) [TI]. The bilateral version applied to two pure generalised Bell 
states (h,mi) and (h,^) yields 

GBXOR[(Zi, mi) ® (Z a , m 2 )} = (h © l 2 , mi) ® (/ 2 , m x e m 2 ). (7) 

Another mathematical tool which we use is the so-called p-norm for tuples of fixed 
length, where p G [1; oo]. For x = (xo, xi, . . . , Xd-i) G C d it is defined by 

/d-i \ Vp 

imi,:= (En p ) ( 8 ) 

for p G [l;oo) and ||x|| ^ := max{|xj| \ i G Z d }. We have ||rr|| > ||a;|| for p < q and 
linip—voQ = H^Hoo- If \xi\ < 1 for all i (which e.g. is the case, if x G Wd), also 
11^ Hp > || x \\ \ holds. Of particular interest is the fact that the 2-norm is invariant with 
respect to a discrete Fourier transform. 



3. Asymptotic correctability for qudit systems 

In this section we consider entanglement purification protocols and their properties. We 
assume that two distant parties, Alice and Bob, share a large amount of mixtures of 
generalised Bell states, i. e. their joint state is p® n for p G <S^ and some large n G N. 
They perform two-way entanglement purification until the use of a CSS code fulfilling 
the quantum Shannon bound allows them to extract some pure generalised Bell state, 
e.g. I^oo)- The quantum Shannon bound is given by the following theorem. 

Theorem 1 (Quantum Shannon Bound) 

Let d be a prime number and consider a state p = (Ai m )f^ =0 G <S^j . If 

AsymCSS,[(A m )t 1 =0 ] := 1 - H d [(A™)^] - H d [(Aj.)fco 1 ] > 0, 
there exists a CSS code which can correct a tensor product state p® n . 
Proof: This is an obvious consequence of a theorem by Hamada (JOj, Theorem 2). □ 

Using this bound, we can now define the notion of asymptotic correctability; due to the 
use of that theorem, in the following we consider d always to be prime. For d = 2, this 
definition reduces to the one given in [3]. 

A correction step of a quantum state purification protocol takes as input a 
state of the form p® n and outputs a state of the form p'® n , where p, p' G S^. In 
general, n' < n and p' is supposed to be more entangled than p. Occasionally, a step 
may fail and does not output anything. As we do not consider distillation rates we can 
drop the labels n and n' . A correction step will thus be treated as a function on <S^ , 
mapping (A lm )f^ =Q to (AJJ^o- 

Definition 1 (Asymptotic correctability) 

Let p = (Ai m )f^ =0 G iS^d an d (Sn)neN be a sequence of possible correction steps in an 
entanglement purification protocol. The state p is called asymptotically si -correctable, 
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if the inequality AsymCSSfSl^p)] > holds for all n > N , where N G N. We call p 
asymptotically non-correctable under the sequence (Sn )neN? z/'AsymCSS[Sl d ' ) (p)] < 
holds for n > Nq for some N G N. 

We now want to generalise the criterion for asymptotic correctability of [3] to qudits. It 
turns out that this generalisation is straightforward and essentially is a reformulation 
of the previous result. The main difficulty in the proof lies in dealing with Shannon 
entropies for d elements instead of the binary Shannon entropy 

As in the qubit case we focus on Taylor expansions of the Shannon entropy. The 
following two lemmata will considerably simplify our approach. 

Lemma 1 (Bounds for the Shannon entropy) 

Let £ = (£o, • • • , £ an d set x n := 5^i=i & = 1 — Co- If we associate to £ the 
distributions £ min := (£ , x n , 0, . . . , 0) and £ max := (£ , fzi, • • • , f^), then 

Hd(£,min) < Hd(Q < Hd(£,max) 

holds, and we calculate 

Hd(£mm) = -(lnd) -1 [f ln£ + Ibz„] , 

ffd((max) = -(^ d)- 1 £ hi £ + %n hi -j-j- 

Proof: See |Appendix A| 

Lemma 2 (A Taylor expansion for the Shannon entropy) 

Let p = (po, ■ ■ ■ ,Pd-i) £ Wd an d denote by g := (1/d, . . . ,1/d) G Wd the uniform 
probability distribution on a set with d elements. Provided that there exists some factor 
f > 0, such that Pi> f/d holds for all i, we have 

H d (p) = 1 - K \\g - p\\l + K'e(p) \\g - pf 3 

for some K, K' > and a bounded function e : Wd —> [—1; 1]. 

Proof: See |Appendix B 



The following theorem now generalises Theorem 1 of [3] to higher dimensions. 
Theorem 2 (Asymptotic correctability) 

Let d be prime and p = (A TO )fm=o *^bd ^ e a s ^ e on which for each n G N a (fictive) 
Sn step is applied to; the resulting state shall be called (A' lm )f^ =0 G <S^ . Define by 



x n := Ylm=i X^f=o ^im the total dit- error rate; 



• y n := \\g — p\\ 2 / y/2 a measure for the deviation of the phase error probability 
p = (A' u )f~Q from the uniform probability distribution g = (1/d, . . . , l/d).\\ 

Provided that the sequence (x n ) n eH converges to zero, we have 

(i) If there exists an r > 2 such that sup {x n /y r n \ n G N} < oo ; then p is asymptotically 
S n - correctable. 

|| The factor y/2 next to y n is only for consistency of notation with the qubit case @J. 
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(ii) If, on the other hand inf {x n /y 2 \n G N} > holds, then p is asymptotically non- 
correctable with respect to that sequence. 

Both statements remain valid, if the role of dit errors and phase errors is interchanged. 

Proof: We may assume that lim n ^oo?/ ra = 0; otherwise our statement follows directly 
from Theorem [TJ Considering the distribution of dit errors £ = (y4 itm )^ and using the 
binary Shannon entropy H(x) = — xlog 2 x — (1 — x) log 2 (l — x), Lemma fallows us to 
write 

H d (0=L-H(x n ) + c(Ox nj (9) 

where L = In 2/ In g? and c : W — > [0; log d (d — 1)] C [0; 1] is some bounded function. By 
Lemma EJ for the distribution of phase errors p due to (2y 2 ) 3 ^ 2 = \\g — p\\\ > \\g ~ p\\\ 
we have 

H d (p) = l-K-2y 2 n + K'e(p) \\g - pf 3 (10) 
= 1 - K ■ 2yl + K'e'ip) ■ (2^) 3 / 2 , (11) 

where K, K' > and e, e' : W d — > [— 1; 1] are bounded functions, provided y n is 
sufficiently small. Setting p' := {A' lm )f'^ =0 yields 

AsymCSS(p') = 1 - H d (0 - H d (p) (12) 

= —L ■ H(x n ) - c(0 x n + 2K ■ y 2 n - 2^[2K'e\p) ■ yl (13) 

that is 

AsymCSS(p') > ~ L ' -c(g) ^ + 2K-2V2K'e'(p)-y n > 0.(14) 

Vn Vn 

In the following, we will also use the property that lim :r ^o+ H(x)/x s = for s G [0; 1) 
and lim a; _ > o+ H(x)/x s = +oo for s G [1; oo). 

For the proof of statement (i), note that condition (i) now implies that x n < cy r n 
for some c > 0, which yields — L ■ H(x n )/y 2 n < —L ■ c 2 ^ r H(x n )/x 2 ^' — > for n — > oo 
due to r > 2. This means that in (JT4"j) all terms except 2K converge to zero. For the 
proof of (ii), we have x n > cy 2 for some c. In a similar fashion as before, this results in 
— L ■ H(x n )/y 2 > — L ■ cH(x n )/x — > — oo. Also, the second term is negative, whereas all 
other terms are bounded, so that for sufficiently large n the quantum Shannon bound 
is not fulfilled. □ 



4. Entanglement purification protocols and asymptotic correctability 

In this section, we want to apply our criterion to an actual sequence of correction steps. 
We therefore focus on a well-known example for two-way entanglement purification, 
which we will call steps and which are defined for any n G N. Considering a state 
p = (A; m )f~ 1 =0 G iSbd, t ne main objective of this section is to derive a condition on p for 
asymptotic B^ -correctability. It will turn out, that we can calculate a characteristic 
exponent r^ d \ such that for the case r^ > 2 we have asymptotic -Bi^-correctability, 
whereas for < 2 we have non-correctability. These results generalise our previous 
results from |lj from qubits to qudits. 
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4-1. Bell diagonal states and Bn steps 

We now introduce a generalisation of the B n step to d dimensions. For n G N, a B^ 
step is defined by the following procedure. 

(i) Alice and Bob arbitrarily choose n qudit pairs QP\, . . . , QP n - 

(ii) Alice and Bob apply n — 1 GBXOR transformations with control QP\ and target 
pairs QP 2 , . . . , QP n . 

(hi) Alice and Bob measure the parity on the pairs QP2, ■ ■ ■ ,QP n and discard the 
measured pairs. They keep QP\, if and only if all parities are zero, otherwise 
they discard it. 

Starting with a tensor product of Bell states, the transformation of step (ii) is given by 



i=i V i=i 



n 



(l k ,m 1 Qm k ) 



k=2 



(15) 



The first pair is thus kept, if mi = holds for all k £ {2, ... , ra}. 

Because we deal with mixtures of generalised Bell states, we want to formulate a 
B^f 1 step as a mapping on the set . This is done in the following theorem. 

Theorem 3 (Evolution of states for B^ steps) 

For each k e {1, . . . , n} let = (A}® )f~ 1 = o e ^ e a s ^ a ^ e - a -^n step zs applied 
to these states and if not all pairs are discarded, the state of the remaining pair is given 
by p' = (^L&=o e S ld with coefficients 

d—l r n d—1 

i=o L fc=i j=o 

where z := exp(27ri/<i) denotes the principal value of the root of unity of order d and 
N '■= S^o[rTfc=i(5^f=o ^im)] ^ s the normalisation constant, i.e. the probability of 
survival of the first qudit pair. Note that the final state is itself Bell diagonal and does 
not depend on the ordering of the initial states. 

Proof: See |Appendix C| 

Although we will not use it, it may be worth mentioning that a sequence of a B^ step 
and a Bm step is equivalent to a single B^) m step. 

4-2. Asymptotic correctability using a sequence of steps 

Before we proceed with the calculation, we have to introduce some notation. As might 
be seen from Theorem |2J we mainly have to focus on purely exponential behaviour, 
that is, in many equations we will skip subexponential terms. To be precise, for some 
non-negative-valued function, we define its exponent by z(f) := lim^oo f(n), where 
we always assume that this limit exists; any such function may now be written as 
f(n) = c(n)z n for some subexponential function c, i.e. some function c such that 
z(c) = 1 holds. We call two-functions / and g asymptotically exponentially equal, if 
z(f) = z(g), in which case we shall write f °= g. 
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For simplicity we will further assume that A* > max{A* m \ m G Z;J} holds; if this 
is not the case, we can apply the local-unitary operation 2®E fceZd \ kQrn)(k\, provided 
that A* m is the unique largest column. We further assume that the phase error rates 
converge to the uniform probability distribution, which is always the case unless the the 
component of the Fourier transform of the first column which has maximum absolute 
value is not unique. 



4-3. Evolution of dit errors 

The evolution of dit errors is straightforward. We denote by £ = (£0, • • • , 62-1) £ Wd 
the distribution of dit errors, i. e. £ m := A* m for m G Z<j. The application of a Bn step 
may be viewed as a mapping B [ n d) defined by 

tn 



Sj 



for i G Z ri 



which follows directly from Theorem El Therefore, using the notation of Theorem El 

n -1 

tn 
SO 



(16) 



,7 



1-^0 



2-um=l Sm 


y-\d— 1 * n 
2—im=0 sm 


-1 


Z-/m=0 w 


_Z_/m=l Sm 





y-vd-1 ^n 

Z-/m=l » 



17) 



Setting £ n 



max{£ m | m G Z^}, the following inequality holds for the denominator: 



d-l 



Smax — / j Sm — V"" /Smax' 



m=l 



Using an appropriate function h : Wd 

-1 

1 + 



[1; d — 1] yields 



.7 ■ ? 



tn 
SO 



: : u(n)x n , 



(19) 



moo* 

where x := £o/£max > 1 and appropriate values u(n) G [1/2; d]. In particular, we have 
and lim^oo £' m = 5 m , so that the correction of dit errors is guaranteed under 



a.e. ~_ 
= X 



B n d ^ steps. 



4-4- The evolution of phase errors 



In comparison to the dit-error evolution, the calculation of the phase errors is more 
sophisticated. For using Theorem|21 we only need to calculate the value 2y 2 n = \\g — p\\\, 
where p is the phase error distribution (pi := A^) and g — (1/d, . . . , 1/d) is the uniform 
probability distribution. By use of Theorem El it follows 

d-l 



\9-p\\2 



dN 



1=0 



(d- 1/2 £ 



~ij T .) . 



. Thus the use of Ylt=o z%k 



d5k,o implies 



y 



d-l 



(20) 



The 2-norm is invariant with respect to a discrete Fourier transform (x» 
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The zero component cancels against the normalisation; this yields 



'Em (£j*'M 

N 



d-l 



1=1 



(22) 



where we take the 2-norm on d — 1 elements only. The evaluation in the general case is 
complicated, although one may expect that in the limit n — > oo only the first column of 
(^m)f m=o snom d be relevant. In the next section we will slightly modify the protocol, so 
that a calculation of the exponential behaviour of 1y\ for the modified protocol becomes 
possible. 



4-5. The mixing operation 

Consider the single-qudit transformation U\ := c/ -1 / 2 ^2 

d-l 

U:=U X ® U* = z y2 ~ x2 \x){x\ ® \y)(y\. 

x,y=0 



d-l 
x=0 ' 



\x){x\ and define 



(23) 



This implies U\^fi m ) = z m \^iQ2m,m) or U : (l,m) t— > (I Q 2m, m). That is, the 
transformation of a Bell-diagonal state by the local unitary operation U permutes the 
coefficients within a fixed column of the coefficient matrix. This property can be used 
to simplify the calculation of 2y^; we therefore introduce the following step immediately 
before Alice and Bob apply the Bn step. 

• For each qudit pair Alice and Bob randomly choose a value n G Z d and apply U n 
to the respective pair. 

Considering a density matrix p, this means p i— > d^ 1 Xln=o U n p(U^) n . For a mixture of 
Bell states, p = (v4i m )f~ 1 =0 , this step mixes the entries in the columns. Complete mixing 
within column m, i.e. A\ m \— > A* m /d, will take place, if 2m and the dimension d are 
coprime. If we want to have complete mixing for all columns except the m = column, 
we have to restrict our considerations to odd primes (which we already did due to the 
use of Theorem ; the case d = 2 (the only even prime) was done in 0] . 
For fixed I 6 Z^, one can calculate 



d-l /d-l 

EE* 

m=0 \j=0 




(24) 
(25) 



and due to I ^ in (j22D it follows 



2y 2 n ■ dN> 



M a . 

/ il 



jo 



d-l 
1=1 



jo 



d-l 
1=1 



2n 



2 n 



(26) 
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It can now be seen, that ||^|| 2 " = K{n) H^H" for any <i-tuple x, where K(ri) G [1; d] may 
depend on x. This yields 

2y 2 n -dN 2 = K{n) (V.^o 



d-1 



1=1 



2n 



K{n) [max{|^.^'A i0 



I G IT, 



1 2n 



(27) 
(28) 



This shows that the determination of the evolution of phase errors is related to the search 
for the largest absolute value of the Fourier transform of a probability distribution, where 
the zero component of the transformed tuple is ignored. 



4-6. Exponential behaviour 

Up to now, we have shown x n a = x~ n , where x = A* / max {^4* m | m G Z^}. This implies 
for the normalisation constant of a B^ step that N n = K'(n) A™ for K'(n) G [l;d]. 
Thus we find N n a = A™ which implies 



a.e. 1 K(n) ( mdX { Ei^iO 



2y; 



The condition x n = y£" J now yields x n 



I e Z* 



2n 



d K'(n 

P (<9 
1 

lnx 



A 



s-0 



or 



K(n) 
K'(n) 



hxy 



In [A* / max {A* m 


m G Z*}] 


In 


A* / max < 








/GZ^ 





~2n 

-■ < 29 > 



(30) 



This generalises the characteristic exponent r from our previous work [I] from qubits to 
qudits. 

Finally, we have to relate the characteristic exponent r'^ to the conditions in 
Theorem |21 this we will do in the following theorem. 

Theorem 4 (Asymptotical I^-correctability) 

A state p = (A/ m )f~ 1 =0 G «s£d asymptotically Bn -correctable, if and only if r^ > 2. 
Proof: Setting r := and using (fTTIj) and ()29|) we find 

K(n) Y r/2 u(n) ( K(n) ^ ~ r/2 



2<n , , - 
— = u{n)x 
if 

■Jn 



Z.-1 



2dK'(n)J (x-y r ) n \2dK'(n)J ^ 

The characteristic exponent r^ is chosen in such a way that (x ■ y r ) n = 1 (in particular, 
x n /y r n a = 1). The remaining terms are bounded for all n G N by some lower bound 
being larger than zero and some upper bound being less than infinity. Thus, Theorem 121 
implies the assertion. □ 



5. Applications in quantum cryptography 

Let us now consider some cryptographical applications of our theorems. In the generic 
model of entanglement-based quantum cryptography, Alice prepares the state l^oo)®" 
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and sends every second qudit to Bob. The transmission is considered to be insecure, 
so that Eve can perform general coherent attacks. The task of Alice and Bob is now 
to estimate the resulting errors and, if possible, to perform entanglement purification. 
This provides Alice and Bob with (nearly) maximally entangled states, from which they 
can extract a secret key. 

Although in general the total state of Alice and Bob is complicated, a random 
permutation of their qudit pairs and a fictive-Bell-measurement argument [2] allows us 
to restrict the theoretical analysis to tensor products of mixtures of generalised Bell 
states. If we consider protocols consisting of one B^ step for an appropriately chosen 
n e N and the application of a CSS code according to Theorem we only have to 
determine the coefficients (v4; m )f~ 1 =0 in order to determine, whether we can obtain a 
secret key. 

A final remark has to be made on prepare-and-measure protocols. The reduction 
of CSS-based protocols for qudits was done by Hamada jTU] and the reduction of 2#> 
steps also follows the well-known lines (cf. e.g. The only remaining point is 

the reduction of our mixing operation; but this mixing only mixes phases and does not 
change any dit value and therefore has no influence on the key. This means Alice and 
Bob can just skip it in the associated prepare-and-measure protocol. 

In the remaining part we will consider states which may appear in a quantum 
cryptographic protocol, and we will also deal with the problem that in general we cannot 
infer all coefficients (^4^ m )f~ 1 =0 from measurements. 

5.1. The generalised isotropic case 

We start with a particularly simple example, namely generalised isotropic states, which 
were also considered in 0. A generalised isotropic state is of the form 

fa 7 ... 7 \ 
/3 5 ... 6 



P = (a,/?, 7, 5) :-- 



(d) 

bd • 



(32) 



V (3 8 ... 8 ) 

7, this is called an isotropic state. An interesting property of generalised isotropic 
states is that they remain of this form, if they are subjected to Bn steps; it is thus 



If/3 



possible to view a B^f* step as a mapping 
coefficients are given by 



(a, (3, 7, 8) I— > (a', /3', j', 8'), where the 



a' 


= {[«+ (d 


- 1)/T + (d 


~l)[a-P} n }/dN, 




= {[a+ (d 


- 1)/T - [a 


- (3] n } /dN, 


i 


= {[l + (d 


~l)5] n + (d- 


-i^-sn/dN, 




= {[l + (d 


- 1)C - [7 - 


- 8} n } /dN, 


N 


= [a + (d - 


■ m n + (d- 


l)[ 7 + (d- !)*]». 


Evaluation of (j3Ti|) 


now yields 







(33) 



In 



a+(d- l)(3~ 
1 + {d-l)8_ 



/In 



~a+ (d- l)(3~ 



a 



(34) 
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and thus > 2 a 2 + (3 2 — 2 [a + (d — l)/3]/d > 0. Using a > (3, we regain the result 
for isotropic channels of our previous work [§]. In the case d = 2, this state reduces to 
the general mixture of qubit Bell states as considered in jlj. Further note, that in the 
case of generalised isotropic channels we could have done the calculation for without 
the use of the mixing operation. 

5.2. Maximum tolerable error rates for two-basis cryptography 

In quantum cryptography, the protocol in [7j produces isotropic states, where f3 = 7 = 5, 
but uses d + 1 mutually orthogonal bases. On the other hand, the theoretical analysis 
of protocols which use only two bases do not, in general, leads to generalised isotropic 
states. 

Let us now focus on protocols which use two Fourier-dual bases and in which the the 
total dit value probabilities A* m (m G Z^) are measured. Such protocols were considered 
in [Hj and it was shown there, that for /, m G Z^ the symmetry relations 

A-lm — A(i-m,l = ^-d-l,d-m = ^m,d-l (35) 

hold for the quantum states describing Alice's and Bob's entanglement. A consequence 
of these relations is = A*i for I G Z^. 

From the measured dit errors A* m a lower bound on has to be inferred. 
From (|3T)|) it can be seen that we need three quantities to calculate r^ d \ namely x := A* m , 
max {/L* m | m G ZJJ} and 

M := maxjl^'V'Ajo 1 1 G Z^j. (36) 

We will write max {Ami m G Z* d } = f ■ (1 - x) ■ (d - l) -1 , where / G [l;d - 1]. The 
case / = 1 is the apparently isotropic case, where all A* m for m G ZjJ are equal, whereas 
/ = d — 1 relates to those cases, in which there are only errors of one type. Equation (1301) 
now reads 

a; \ / x \ - 1 
f^)-{ n M 

The values of x and / can be directly inferred from the measured dit-error probabilities. 
However, estimating the value of M is more involved. We note that small values of M 
correspond to small values of r^ d \ So, for a lower bound on r" we need a lower bound 
on M, which will be derived now. 

For any complex number z G C, we have \z\ > Rez and the maximum over all 
I G Z^ is definitely larger than the average over this set. We thus have 

M > max {iteX)^ zlj ^°\ leZ d}> Re JTJ Htl ^;=o ^ ^ (38) 
Exchanging the summation and using the fact that ^f=i z ^ = ^j,o — 1 yields 

M > — J2~J d5 io - l)A j0 = A 00 - ^f^- (39) 



- (d) -(ln^]-(ln^) . (37) 
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Note that in the case of the generalised isotropic channel this is an equality. Up to this 
point we have given a simple, but achievable lower bound on M. In order to infer this 
lower bound from the qudit-error probabilities measurable in the protocol we use the 
relations 

d-l d-l d-l 

A*) = A 00 + J2 A io < A 00 + J2 A i* = A 00 + J2 A *i = A)o + (l-^*o), (40) 
1=1 1=1 1=1 

which imply A 00 > 2A* — 1. Note that equality holds, if and only if Ai m = for 

(l,m) e^x Z* d . Plugging this bound into the bound for M yields 

M>x-d-^-— -. (41) 
a — 1 

The isotropic channel of flHH) is the worst case with respect to correctability (i. e., it has 
the smallest r^) of all apparently isotropic channels, i.e. channels where A* m = A* m i 
for all m, m' G Z* d . Furthermore, we have equality in (J4U|) and thus in (J41)) . if for this 
isotropic channel 5 = holds; this case was considered in |9,. If we do not have an 
isotropic channel, the tolerable error rate according to our bound depends on /, which 
can be seen as a parameter characterizing the non-isotropy of the measured probability 
distribution. 

By plugging in our bound for M and solving for x = A*o, we get as a sufficient 
condition for correctability 

2d(2d-l) + (d-l)(f + y /(4d + f)f) 

2[(2d-l)* + (d-l)/] ' 1 ] 

where we only consider x > (d + l)/(2d) due to the entanglement bound of jH]. In 
figure Q we plotted bounds on the maximum tolerable error rate (1 function 
of d. The upper line is the apparently isotropic case (/ = 1), the lower one the case 
with just one type of error (/ = d — 1). The lower bound for the maximum tolerable 
error rate in a given protocol lies between these two lines. We thus have shown lower 
bounds on the maximum tolerable error rates of two-basis quantum cryptography using 
the protocols considered. In case of apparently isotropic channels our bounds are exact 
lower bounds, in other cases they become worse the more non-isotropic the channel gets. 



6. Conclusions 

We have generalised the ideas of our previous work [3] , namely the notion of asymptotic 
correctability, to d-dimensional quantum systems. We determined a criterion for 
asymptotic correctability and applied it to Brf 1 steps, which yielded an expression for 
the characteristic exponent related to asymptotic si^-correctability. Applying this 
condition to cryptographic protocols yielded lower bounds for maximum tolerable error 
rates and the bound in the case of apparently isotropic channels is tight. 

Up to now our proof relies on the existence of asymmetric CSS codes for d 
dimensions JUj- If such codes exist for non- prime dimensions (e.g. prime powers), 
our result can be easily generalised to these dimensions, provided the mixing operation 
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2 3 5 7 11 13 17 19 

d 

Figure 1. Lower bounds for the maximum tolerable error rate (1 — x = 1 — A*o) as 
a function of the dimension d: the upper line corresponds to the apparently isotropic 
case / = 1 (where this bound is exact), the lower one to the maximum non-isotropy 
/ = d— 1. All other cases lie in between. The lines start at 1 — x = 0.2, the upper one 
converges to 0.5, the lower one to 1/2- 1/2V5 w 0.276. 




is adapted accordingly. It would also be interesting to explicitly calculate the value 
M = max | X]j=o ^'-Aj'o \l £ ^dj; if Ao are known for all I G and to infer better 
bounds on M for the non-isotropic case by using the symmetry relations of two-bases 
protocols, but both tasks seem to be relatively complicated. 
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Appendix A. Proof of Lemma [T] 

By definition of the Shannon entropy, it is obvious that it is invariant with respect to 
any permutation of the £j. Furthermore, we know that it is concave, i. e. 

H d (X • £ + (1 — A) • 77) > XH d (0 + (1 - X)H d ( V ) for A G [0; 1]. (A.l) 

One now can see that £ max can be represented as a mixture of permutations of £, where 
£0 is left invariant, and, on the other hand, £ can be constructed by a mixture of 
permutations of £ min . □ 

Appendix B. Proof of Lemma [2] 

A Taylor expansion of H d up to second order around g yields 

H d ( P ) = 1 + £ (l - ( Pi - 9i ) - ^- f> - Pl ) 2 + RM- (B.l) 
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Due to the fact that we only consider probability distributions p, the first order term 
vanishes and the second order term can be written in the form of Lemma El using 
K := d/(2\nd). The remainder term i?2(p) can be calculated by Lagrange's formula, 
i. e. 

i=0 

for some set pi, where pi < pi < 1/d or 1/d < pi < Pi holds for any i. By assumption, 
we have pi > f/d; this yields 

l^(p)l ^ E - lb - (B.3) 

for if' := d 2 ■ (3!/ 2 ■ lnc?) -1 , which concludes the proof. □ 



Appendix C. Proof of Theorem El 



In this section, we give the proof of TheoremEl which closely follows the ideas presented 
in The main idea in the proof is that the phase propagation can be seen as a 

convolution, which can be calculated by a sequence of Fourier transform, multiplication 
and inverse Fourier transform. 

The proof is done by induction, which (the case n — 1 being obvious) we start for 
n = 2. Consider (Ai m )i m , (B st ) st 6 S$ and denote (l,m) : = |^ m )(^m|- Applying steps 
(i) and (ii) of a B„ step in this case yields 

P = Y, A im(l, m)®Yl Bsf ( s > *) = E A imB s t(l, m) <g> (s, t) (C.l) 



l,m 
GBXOR 



h-> V} Ai m B st (l © s, m) ® (s, mQt). 



(C.2) 



l,m,s,t 



Considering only the case where m6i = and tracing out the second pair further yields 



lQl',m 



(l,m) 



(C.3) 



iV 2 1 A lm B sm (l © s, m) = 

l,m,s Im 

where N 2 = [(z~2i A im)(z~2i Bim)] is the normalisation constant. We assume now that 
the theorem is true for all numbers upto a fixed value n and proceed via induction: Let 
pM = (A^ l )f'^_ be mixtures of Bell states for i e {1, . . . , n + 1}. The outcome of a Bn 
step applied to the states 1, . . . , n shall be denoted as p' = {A' lm )^ =Q with normalisation 
constant N n , the outcome of a i^+j on all n + 1 states shall be p" = (A'i m )f^ =0 . We 



calculate 



4" 



dN< 



— V 



d?N 2 N 1 



n+l / 



> j 



fc=i 



(C.4) 
(C.5) 
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k=l \ j' / 

where N 2 is the normalisation constant for a Brf 1 step with n = 2 applied to p' and 
p(«+i). Using V^^Tq 1 = d^y, this implies the assertion, if the normalisation constant 

is correct. This can be verified by direct calculation. □ 
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